CVE-2026-13478: bounds in zephyrproject zephyr

The Zephyr ext2 filesystem driver improperly validates the on-disk block bitmap size during ext2_init_fs(). It calculates fs_blocks as s_blocks_count - s_first_data_block from the superblock without bounding it against the bitmap buffer capacity (fs->block_size * 8 bits). A crafted ext2 image with an oversized s_blocks_count (up to ~4 billion) causes ext2_bitmap_count_set() to read roughly 512 MB beyond the bitmap block, resulting in a large out-of-bounds read. This occurs during the mount operation on attacker-supplied ext2 images. The out-of-bounds read leads to a system crash (denial of service) but does not leak attacker-controlled data. The fix rejects images where fs_blocks exceeds fs->block_size * 8 before scanning.

The vulnerability causes a large out-of-bounds read of memory during mounting of a malicious ext2 image, leading to a system crash (denial of service). There is no confidentiality or integrity impact as no attacker-controlled data is returned or executed. The denial of service occurs because the out-of-bounds read crosses memory boundaries that trigger faults.

A fix is available that rejects ext2 images with an oversized block count exceeding the bitmap capacity before scanning. Users should upgrade to Zephyr version 4.4.2 or later where this issue is addressed. Until patched, avoid mounting untrusted ext2 images to prevent denial of service.